Question

我正在使用azure函数开发一些有关创建网站集的功能。我的步骤如下：

使用管理员创建网站集（通过clientid和client secret）
获取新的URl客户端上下文以更新一些信息，例如组成员网站所有者等

我现在遇到一个问题，首先我使用使用帐户和密码来获取新的客户端上下文，然后更新站点属性，但是现在无法使用它导致新的公司策略。我该如何改善解决此问题的方法？

public ClientContext GetClientContextByCredential(SharePointOnlineCredentials cred, bool tryNewSite)
        {
            ClientContext ctx = ContextInit;
            try
            {
                ctx.Credentials = cred;
                Web web = ctx.Web;
                ctx.Load(web, w => w.Url);
                ctx.ExecuteQuery();

                return ctx;
            }
            catch (Exception ex)
            {
                ctx = null;
                if (_logHelper != null)
                {
                    if (tryNewSite)
                    {
                        _logHelper.writeLog(ex.Message, TraceLevel.Info, ex);
                    }
                    else
                        _logHelper.writeLog(ex.Message, TraceLevel.Error, ex);
                }
                return ctx;
            }
        }

使用SharePointOnlineCredentials

时会出现此类错误

The remote server returned an error: (401) Unauthorized.

Answer 1

如果要使用Azure AD应用程序在线连接SharePoint，请参考以下步骤

创建一个Azure AD应用程序

Connect-AzureAD 

# Create the self signed cert if you have the cert, please skip it
$currentDate = Get-Date
$endDate  = $currentDate.AddYears(1)
$notAfter  = $endDate.AddYears(1)
$pwd  = "<password>"
$thumb = (New-SelfSignedCertificate -CertStoreLocation cert:\localmachine\my -DnsName com.foo.bar -KeyExportPolicy Exportable -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -NotAfter $notAfter).Thumbprint
$pwd = ConvertTo-SecureString -String $pwd -Force -AsPlainText
Export-PfxCertificate -cert "cert:\localmachine\my\$thumb" -FilePath c:\temp\examplecert.pfx -Password $pwd

# Load the certificate
$cert  = New-Object System.Security.Cryptography.X509Certificates.X509Certificate("C:\temp\examplecert.pfx", $pwd)
$keyValue = [System.Convert]::ToBase64String($cert.GetRawCertData())


# Create the Azure Active Directory Application
$application = New-AzureADApplication -DisplayName "test123" -IdentifierUris "https://test123"
New-AzureADApplicationKeyCredential -ObjectId $application.ObjectId -CustomKeyIdentifier "Test123" -StartDate $currentDate -EndDate $endDate -Type AsymmetricX509Cert -Usage Verify -Value $keyValue

通过Azure门户配置权限
将证书上传到Azure密钥库

$Password = ConvertTo-SecureString -String "123" -AsPlainText -Force
Import-AzKeyVaultCertificate -VaultName "ContosoKV01" -Name "ImportCert01" -FilePath "C:\temp\examplecert.pfx" -Password $Password

配置Azure功能

a。 Configure MSI for function app

b。在Key Vault中为您先前创建的应用程序标识创建一个access policy。启用此策略的“获取”秘密权限。

c。代码

public ClientContext GetClientContextByCredential()
      {
          ClientContext ctx = ContextInit;
          try
          {
               ctx  = new AuthenticationManager().GetAzureADAppOnlyAuthenticatedContext(
      siteUrl,
      ApplicationId,
      tenant + ".onmicrosoft.com",
      GetKeyVaultCertificate("kv-spo", "AzureAutomationSPOAccess")))
      {
      ctx  .Load(cc.Web, p => p.Title);
      ctx  .ExecuteQuery();

              return ctx;
          }
          catch (Exception ex)
          {
              ctx = null;
              if (_logHelper != null)
              {
                  if (tryNewSite)
                  {
                      _logHelper.writeLog(ex.Message, TraceLevel.Info, ex);
                  }
                  else
                      _logHelper.writeLog(ex.Message, TraceLevel.Error, ex);
              }
              return ctx;
          }
      }

 internal static X509Certificate2 GetKeyVaultCertificate(string keyvaultName, string name)
{


      var serviceTokenProvider = new AzureServiceTokenProvider();
     var  keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(serviceTokenProvider.KeyVaultTokenCallback));


  // Getting the certificate
  var secret = keyVaultClient.GetSecretAsync("https://" + keyvaultName + ".vault.azure.net/", name);

  // Returning the certificate
  return new X509Certificate2(Convert.FromBase64String(secret.Result.Value));


}

有关更多详细信息，请参阅

https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread

https://docs.microsoft.com/en-us/archive/blogs/richard_dizeregas_blog/performing-app-only-operations-on-sharepoint-online-through-azure-ad

如何使用功能应用程序更新共享点在线网站集

1 个答案: